CVE-2024-45853

Advisory

MindsDB affected versions contain a critical security vulnerability in the 'inhouse' model functionality. Malicious actors can exploit this flaw to execute arbitrary code on the server during prediction tasks. The vulnerability stems from unsafe deserialization of untrusted data in the BYOM (Bring Your Own Model) feature. Attackers who successfully upload a compromised 'inhouse' model can trigger the exploit when the system uses the model for predictions. This security issue poses a significant risk to server integrity and data confidentiality. Users are advised to update to a patched version or implement alternative serialization methods immediately.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-q9r8-89xr-4xv4
• https://github.com/mindsdb/mindsdb/blob/v24.9.2.1/mindsdb/integrations/handlers/byom_handler/byom_handler.py#L424-L431
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45853